cyber.hendryadrian.com
Security News · cyberscoop.com

China-Aligned TA419 Targets U.S. AI Policy Experts in Credential-Phishing Campaign

· Original article ↗

Summary

Proofpoint says China-aligned group TA419 used impersonation and fake Microsoft OneDrive sign-in pages to target U.S. AI policy experts and steal credentials and browser sessions. The report did not confirm account compromises.

Key points

  • TA419 targeted people connected to think tanks, universities, law firms and defense-related institutions with phishing emails framed around AI policy.
  • The group impersonated U.S. officials, an economist and an Anthropic employee to build trust with targets.
  • After a target replied, attackers sent a shortened link that redirected to a fake Microsoft OneDrive sign-in page.
  • Proofpoint said the adversary-in-the-middle setup could capture credentials and active browser sessions, including after a victim completed multifactor authentication.
  • The operation used a modified version of the Frameless BitB phishing tool to display a fake sign-in window.
  • Proofpoint reported activity dating back to at least April 2025 and said the report did not identify victims or confirm compromised accounts.

Article Details

Event Type
Phishing and cyber espionage campaign targeting U.S. AI policy experts.
Impact
The operation sought to steal Microsoft account credentials and active browser sessions. Proofpoint did not identify victims or report whether any accounts were compromised.

MITRE ATT&CK

T1539 · Steal Web Session CookieThe phishing setup was intended to capture active browser sessions created during sign-in.T1566.002 · Spearphishing LinkTA419 sent phishing emails containing links that redirected recipients to a fake Microsoft OneDrive sign-in page.

People

Heidi Crebo-RedikerAn economist and foreign policy expert whose identity TA419 impersonated in phishing emails.Lynne ParkerA former principal deputy director of the White House Office of Science and Technology Policy whose identity TA419 impersonated in phishing emails.

Threat Actors

TA419A China-aligned group that Proofpoint attributed the phishing campaigns to; the report did not directly link the activity to the Chinese government.

Vendors

AnthropicAI policy experts with phishing emails impersonating officials, economists, and an Anthropic employee to steal Microsoft account credentials and browser sessions.MicrosoftAI policy experts with phishing emails impersonating officials, economists, and an Anthropic employee to steal Microsoft account credentials and browser sessions.

Products

Claudethink tank for feedback on the military’s use of Anthropic’s Claude AI models, which was a highly controversial topic at time.Microsoft OneDriveVictims were lured to a fake Microsoft OneDrive sign-in page to capture credentials and sessions.

Tools

Frameless BitBProofpoint said the attackers used a modified version of the Frameless BitB phishing tool.

Countries

ChinaA China-aligned group called TA419 targeted U.S.JapanThe group also registered domains resembling real organizations, including the Heritage Foundation, the World Economic Forum and the Japan-Taiwan Exchange Association.United StatesChina has repeatedly denied conducting cyber espionage, while accusing the United States of cyber operations against Chinese interests.

Industries

Artificial intelligenceartificial intelligence policy experts.DefenseThe campaign targeted people tied to think tanks, universities, law firms, and defense-related institutions.Think tanksProofpoint said the campaign focused on people at think tanks, universities, and law firms amid escalating U.S.-China competition over AI policy and technology.

Related Articles